wholecode

<?php

mysql_connect("localhost","user", "pw") or die(mysql_error);
mysql_select_db("dbname");

$pass = mysql_real_escape_string(htmlspecialchars($_POST['pass']));
$pass2 = mysql_real_escape_string(htmlspecialchars($_POST['pass2']));
$code = $_POST['code2'];
$sql = mysql_query("SELECT email FROM pw_ask WHERE code='$code'");
$row = mysql_fetch_array($sql);
$email = $row['email'];

if($pass == $pass2)
{
$pass3 = md5($pass);

mysql_query("UPDATE users SET password='$pass3' , newpw_code='' where email='$email'");
mysql_query("DELETE FROM pw_ask where code='$code'");

header("location:index.php?ret=pw");
}
?>